ClickFix - Suspicious PowerShell and LOLBin Activity via RunMRU Registry Keys
Detects the execution of suspicious commands, PowerShell scripts, or LOLBins (Living-off-the-Land Binaries) - commonly seen in ClickFix and CrashFix campaigns - recorded in the Windows 'RunMRU' registry key.
Microsoft Sentinel (KQL)
